{"schema_version":"1.9.0","id":"CVE-2020-7774","published":"2020-11-17T13:15:12.633Z","modified":"2026-09-07T03:45:05.376738212Z","aliases":["GHSA-c4w7-xm78-47vh"],"related":["ALSA-2020:5499","ALSA-2021:0548","ALSA-2021:0551","SNYK-JAVA-ORGWEBJARSNPM-1038306","SNYK-JS-Y18N-1021887","SUSE-SU-2021:2319-1","SUSE-SU-2021:2323-1","SUSE-SU-2021:2326-1","SUSE-SU-2021:2327-1","SUSE-SU-2021:2353-1","SUSE-SU-2021:2354-1","SUSE-SU-2021:2618-1","SUSE-SU-2021:2620-1","openSUSE-SU-2021:1059-1","openSUSE-SU-2021:1060-1","openSUSE-SU-2021:1061-1","openSUSE-SU-2021:1113-1","openSUSE-SU-2021:2327-1","openSUSE-SU-2021:2353-1","openSUSE-SU-2021:2354-1","openSUSE-SU-2021:2618-1","openSUSE-SU-2024:11096-1"],"details":"The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/graalvm/graalvm-ce-builds","events":[{"introduced":"251e15bf41dcc0c1b4e3debdb7d01f7082734ddd"},{"last_affected":"2ada493c63db015cc41bca1021f0e567f51893c6"}],"database_specific":{"cpe":["cpe:2.3:a:oracle:graalvm:19.3.5:*:*:*:enterprise:*:*:*","cpe:2.3:a:oracle:graalvm:20.3.1.2:*:*:*:enterprise:*:*:*","cpe:2.3:a:oracle:graalvm:21.0.0.2:*:*:*:enterprise:*:*:*"],"extracted_events":[{"introduced":"19.3.5"},{"last_affected":"19.3.5"},{"introduced":"20.3.1.2"},{"last_affected":"20.3.1.2"},{"introduced":"21.0.0.2"},{"last_affected":"21.0.0.2"}],"source":"CPE_STRING"}}],"versions":["19.3.5","20.3.1.2","21.0.0.2","vm-21.0.0.2","vm-21.0.0","vm-20.3.1","vm-19.3.5"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7774.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/yargs/y18n","events":[{"introduced":"5553c05002da5a4ad8c52662b54513ebace74331"},{"fixed":"e343b70fbe8245c0a02a5615eee1bbd6bcaac1d6"},{"introduced":"45d2568800d6c57be045e76dc4984b2ef3432233"},{"last_affected":"45d2568800d6c57be045e76dc4984b2ef3432233"}],"database_specific":{"cpe":["cpe:2.3:a:y18n_project:y18n:*:*:*:*:*:node.js:*:*","cpe:2.3:a:y18n_project:y18n:4.0.0:*:*:*:*:node.js:*:*"],"extracted_events":[{"introduced":"5.0.0"},{"fixed":"5.0.5"},{"introduced":"4.0.0"},{"last_affected":"4.0.0"}],"source":["CPE_RANGE","CPE_STRING"]}}],"versions":["4.0.0","v4.0.0","v5.0.5","v5.0.4","v5.0.3","v5.0.2","v5.0.1","v5.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-7774.json"}}],"references":[{"type":"FIX","url":"https://cert-portal.siemens.com/productcert/pdf/ssa-389290.pdf"},{"type":"FIX","url":"https://github.com/yargs/y18n/pull/108"},{"type":"FIX","url":"https://www.oracle.com/security-alerts/cpuApr2021.html"},{"type":"EVIDENCE","url":"https://github.com/yargs/y18n/issues/96"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1038306"},{"type":"EVIDENCE","url":"https://snyk.io/vuln/SNYK-JS-Y18N-1021887"}],"database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:a:siemens:sinec_infrastructure_network_services:*:*:*:*:*:*:*:*"],"extracted_events":[{"fixed":"1.0.1.1"}],"source":"CPE_RANGE","vendor_product":"siemens:sinec_infrastructure_network_services"},{"cpes":["cpe:2.3:a:y18n_project:y18n:*:*:*:*:*:node.js:*:*"],"extracted_events":[{"fixed":"3.2.2"}],"source":"CPE_RANGE","vendor_product":"y18n_project:y18n"}]},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}